Executive brief
Matrix Synapse is a homeserver implementation for the Matrix communication protocol that handles federation (communication between independent servers). A malicious server operator could exploit a flaw in how Synapse validates .well-known file requests, redirecting requests to extremely large files and causing legitimate servers to consume excessive resources and become unresponsive. This affects any Synapse deployment that accepts federation requests from untrusted servers.
Technical details
The vulnerability is an uncontrolled resource consumption / denial of service attack (CWE-400, CWE-770) in Synapse's federation .well-known lookup mechanism. When a Synapse server requests the .well-known file from another server during federation setup, it does not properly validate the response size or implement request timeouts. An attacker running a malicious homeserver can redirect the .well-known request to a large file, causing the victim server to consume significant memory and bandwidth fetching and processing the oversized response. The attack vector is network-based and requires no authentication or special privileges; it affects servers that accept federation requests. The fix was implemented in PR #8950, with version 1.25.0 being the first patched release.
Affected products
- Matrix Synapse 0.99.0 through 1.24.0 (fixed in 1.25.0)
Timeline
- 2021-02-25: disclosed
- 2021-03-01: patched: Fixed in version 1.25.0